cursedops 0.10.16 → 0.10.18

package/README.md

@@ -28,7 +28,7 @@ bun add cursedops
 | `cursedops/relay` | the WORKER half of a relay — a Worker in front of a Mac-bound app over ONE outbound WebSocket: the frames (station's wire, byte for byte), the key-digest door (`acceptLink`), and `RelayLink`, the Durable Object an app subclasses with its name, body ceiling, timeout and (optionally) station's per-cookie offline cache. No `node:` import (0.10.0, lifted from station for roms, task 065) |
 | `cursedops/relay-link` | the MAC half — `dialLink` (answer each frame with the app's own `fetch`, redial 1 s → 60 s on close, no timer otherwise), `readLinkSettings` for `<APP>_LINK_URL`/`<APP>_LINK_KEY`, and `rotateLinkKey` (digest to the Worker FIRST, the key to the 0600 file only if it took) (0.10.0) |
 | `cursedops/relay-stage` | the signed-in STAGE WALK's skeleton both relay apps shared — `stageByteCheck` (SHA-256 of every built file, a stale byte re-asked 4 × 10 s), `putStageLinkDigest` (`--env stage` only), `grantStageOwner` (auth-stage's 2FA grant, never production's), `oldKeyRefused` (the rotation leg: 20 s refused window, 3 min ceiling), `awaitSystemResolver`, `servedPath`, `STAGE_AUTH_URL`. With `relayWorkerDeployCli` in `cursedops/worker-deploy`, a relay app's whole `worker:deploy` as data (0.10.6) |
-| `cursedops/public-client` | does a relay app's PUBLIC hostname serve the client this release built? `comparePublicClient` (built assets the shells name, never bodies), `stagedShell`, `publicShell` (cache-busted, Access headers as an option), `recordPublicClient` — the smoke's `public-client` row, an EDGE fault (exit 2, never a rollback) — and `shipClientIfBehind`, the deploy step that runs `worker:deploy` when the public shell is behind. Lifted from roms for station (0.10.8) |
+| `cursedops/public-client` | does a relay app's PUBLIC hostname serve the client this release built? `comparePublicClient` (built assets the shells name, never bodies), `stagedShell`, `publicShell` (cache-busted, Access headers as an option), `recordPublicClient` — the smoke's `public-client` row, an EDGE fault (exit 2, never a rollback) — and `shipClientIfBehind`, the deploy step that runs `worker:deploy` when the public shell is behind. Lifted from roms for station (0.10.8). `stagedBuild` + `publicBuild` (0.10.18): pass `stagedBuild` and the commit the public `/build.json` names must be this release's too — `/`'s asset names cannot see a change to another page or a fixed-name file |
 | `cursedops/public-surface` | the ratchet on a LIBRARY's public surface — a symbol count per export subpath against a committed baseline that may only fall — and its `public-surface` bin. Not an app's: the one entry here admitted for three published libraries, see below |
 
 Bun, zero runtime dependencies, ships TypeScript source. Nothing here knows an app's

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.10.16",
+	"version": "0.10.18",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/edgeFetch.ts

@@ -73,15 +73,20 @@ const EDGE_RETRIES = 2;
  *  · 6 resolve, 7 connect, 35 TLS handshake — the request never left this machine, so a replay
  *    is always safe, whatever the method;
  *  · 52 empty reply, 56 receive failure — the request MAY have reached the Worker and done its
- *    work, so these are replayed only for a method that is safe to run twice (never a POST).
+ *    work, so these are replayed only for a method that is safe to run twice (never a POST);
+ *  · 28 timeout — the far end may still be working, so the same rule, and ONCE only: a replay
+ *    costs a whole `--max-time`, and a Worker that is really down must not hold a smoke for
+ *    three of them. Measured 2026-09-26: flix's prod smoke went red on one `curl exit 28` for
+ *    `GET /healthz` while the same URL answered 200 in 0.2 s seconds later (task 2190).
  *
- * Every other exit — 28 (timeout) above all, where the far end may still be working — and every
- * HTTP status, whatever it is, is returned exactly as before.
+ * Every other exit, and every HTTP status, whatever it is, is returned exactly as before.
  */
-function retryableCurlFailure(exit: number | null, stdout: Buffer, method = "GET"): boolean {
+function retryableCurlFailure(exit: number | null, stdout: Buffer, method = "GET", retry = 1): boolean {
 	if (stdout.length > 0 || exit === null) return false;
 	if (exit === 6 || exit === 7 || exit === 35) return true;
-	return (exit === 52 || exit === 56) && ["GET", "HEAD", "OPTIONS", "PUT", "DELETE"].includes(method.toUpperCase());
+	const replayable = ["GET", "HEAD", "OPTIONS", "PUT", "DELETE"].includes(method.toUpperCase());
+	if (exit === 28) return replayable && retry === 1;
+	return (exit === 52 || exit === 56) && replayable;
 }
 
 function digCloudflare(host: string): string | null {
@@ -170,7 +175,7 @@ export function createEdgeFetch(options: EdgeFetchOptions = {}): (url: string, i
 		}
 		try {
 			let out = curl([...head(), ...args, target.toString()]);
-			for (let retry = 1; retry <= EDGE_RETRIES && retryableCurlFailure(out.status, out.stdout, init.method); retry++) {
+			for (let retry = 1; retry <= EDGE_RETRIES && retryableCurlFailure(out.status, out.stdout, init.method, retry); retry++) {
 				await new Promise((r) => setTimeout(r, options.retryDelayMs?.(retry) ?? 500 * retry));
 				// `head()` again: a host with no pin yet is asked again, so a retry can find the address.
 				out = curl([...head(), ...args, target.toString()]);

package/src/publicClient.ts

@@ -24,6 +24,17 @@
  *
  * `headers` is how an app behind Cloudflare Access (station) passes the fleet's service token; an
  * anonymous `/` there is a 302 to the Access issuer, which names no built asset and never matches.
+ *
+ * ## 🔴 `/` is ONE page — pass `stagedBuild` and the BUILD is compared too (0.10.18)
+ *
+ * The asset names in `/` only see a change that reaches `/`'s own chunks. roms `95fa4b24`
+ * (2026-09-27) changed only its PS2 player — `ps2.html` and the `ps2-*.js` chunk nothing else
+ * loads — and this said "already serving it": the public `/` named the same files, and players
+ * kept the old player until `worker:deploy` was run by hand. A fixed-name file (roms'
+ * `emulator-runtime.js`, a service worker) is invisible to a name comparison by construction.
+ * So an app whose client is stamped (`forge-client stamp` writes `build.json`, which the Worker
+ * serves with the rest of the client) passes `stagedBuild(dataDir)`, and the commit the public
+ * `/build.json` names must equal the staged one. That is every page and every file at once.
  */
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, statSync } from "node:fs";
@@ -61,6 +72,34 @@ export function stagedShell(dataDir: string): string | null {
 	}
 }
 
+/**
+ * The commit the staged client was built from — its `build.json` (`forge-client stamp`) — or
+ * `null` when nothing is staged or it carries no commit.
+ */
+export function stagedBuild(dataDir: string): string | null {
+	const dir = stagedClientDir(dataDir);
+	if (!dir) return null;
+	try {
+		const commit = (JSON.parse(readFileSync(join(dir, "build.json"), "utf8")) as { commit?: unknown }).commit;
+		return typeof commit === "string" && commit !== "" ? commit : null;
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * Pure: `null` when the public client's build commit is this release's, otherwise the sentence
+ * saying why not. A missing public commit is behind — nothing then proves which client people get.
+ */
+export function buildBehind(served: string | null, built: string): string | null {
+	if (!served) return "the public /build.json names no commit — nothing proves which client people get";
+	if (served.startsWith(built) || built.startsWith(served)) return null;
+	return (
+		`the public client was built from ${served.slice(0, 8)} and this release from ${built.slice(0, 8)} — ` +
+		"a page other than / (or a file with a fixed name) changed while / did not"
+	);
+}
+
 export interface PublicShellOptions {
 	/** Sent with the request — Cloudflare Access service-token headers for an app behind Access. */
 	headers?: Record<string, string>;
@@ -82,6 +121,25 @@ export async function publicShell(base: string, options: PublicShellOptions = {}
 	return { status: response.status, html: await response.text().catch(() => "") };
 }
 
+/** The commit the PUBLIC client's `/build.json` names, cache-busted — or `null` when it cannot be read. */
+export async function publicBuild(base: string, options: PublicShellOptions = {}): Promise<string | null> {
+	const url = new URL("/build.json", base);
+	url.searchParams.set("cb", Math.random().toString(36).slice(2));
+	const ask = options.fetch ?? ((u: string, init: RequestInit) => fetch(u, init));
+	try {
+		const response = await ask(url.toString(), {
+			redirect: "manual",
+			signal: AbortSignal.timeout(options.timeoutMs ?? 20_000),
+			headers: { accept: "application/json", ...(options.headers ?? {}) },
+		});
+		if (!response.ok) return null;
+		const commit = ((await response.json()) as { commit?: unknown }).commit;
+		return typeof commit === "string" && commit !== "" ? commit : null;
+	} catch {
+		return null;
+	}
+}
+
 /** The sentence both the smoke and the deploy print when the halves disagree. `root` is the app's checkout. */
 export function workerBehind(verdict: PublicClientVerdict, base: string, root: string): string {
 	return (
@@ -94,6 +152,8 @@ export function workerBehind(verdict: PublicClientVerdict, base: string, root: s
 export interface RecordPublicClientOptions extends PublicShellOptions {
 	/** The app's checkout, for the pasteable `worker:deploy` command. */
 	root: string;
+	/** {@link stagedBuild} — when given, the public `/build.json` must name the same commit. */
+	stagedBuild?: string | null;
 }
 
 /**
@@ -113,15 +173,22 @@ export async function recordPublicClient(smoke: Smoke, staged: string | null, op
 	}
 	const { html } = await publicShell(smoke.base, options);
 	const verdict = comparePublicClient(html, staged, smoke.base);
+	let behind: string | null = null;
+	if (verdict.matched && options.stagedBuild) {
+		behind = buildBehind(await publicBuild(smoke.base, options), options.stagedBuild);
+	}
+	const matched = verdict.matched && behind === null;
 	smoke.record(
 		PUBLIC_CLIENT_CHECK,
-		verdict.matched,
-		verdict.matched
-			? `the public shell names this release's build — ${verdict.built.join(", ")}`
-			: workerBehind(verdict, smoke.base, options.root),
+		matched,
+		matched
+			? `the public shell names this release's build — ${verdict.built.join(", ")}${options.stagedBuild ? `, built from ${options.stagedBuild.slice(0, 8)}` : ""}`
+			: behind !== null
+				? `🔴 ${behind}. The public client is the relay Worker's static assets — \`cd ${options.root} && bun run worker:deploy\``
+				: workerBehind(verdict, smoke.base, options.root),
 	);
-	if (!verdict.matched) smoke.markEdgeFault();
-	return verdict.matched;
+	if (!matched) smoke.markEdgeFault();
+	return matched;
 }
 
 /**
@@ -187,6 +254,8 @@ export interface ShipClientOptions extends PublicShellOptions {
 	git?: (root: string, args: readonly string[]) => { status: number | null; stdout: string };
 	/** What the Worker is built from ({@link workerInputs}); default computed from `root`. */
 	workerInputs?: readonly string[];
+	/** {@link stagedBuild} — when given, a public `/build.json` naming another commit is behind too. */
+	stagedBuild?: string | null;
 	log?: (line: string) => void;
 }
 
@@ -241,7 +310,11 @@ export async function shipClientIfBehind(options: ShipClientOptions): Promise<Sh
 			() => "",
 		);
 		before = comparePublicClient(html, options.staged, options.base);
-		if (before.matched) {
+		const clientBehind =
+			before.matched && options.stagedBuild ? buildBehind(await publicBuild(options.base, options), options.stagedBuild) : null;
+		if (clientBehind !== null) {
+			log(`  ${clientBehind} — shipping the Worker's client`);
+		} else if (before.matched) {
 			// 🔴 The client matching is not the Worker matching: roms 86e5e522 changed only
 			// worker/index.ts, this said "already serving it", and /healthz kept answering the
 			// previous Worker until worker:deploy was run by hand (2026-09-25).
@@ -261,8 +334,7 @@ export async function shipClientIfBehind(options: ShipClientOptions): Promise<Sh
 			log("  running `bun run worker:deploy` — the stage walk, then production");
 			const status = (options.runWorkerDeploy ?? spawnWorkerDeploy)(options.root);
 			return { outcome: status === 0 ? "shipped" : "failed", status, before, workerBehind: behind };
-		}
-		log(`  ${workerBehind(before, options.base, options.root)}`);
+		} else log(`  ${workerBehind(before, options.base, options.root)}`);
 	} else {
 		log("  nothing staged to compare with — shipping the Worker's client anyway");
 	}